Mozilla

Mozilla

Mozilla Foundation Security Advisory 2011-07

Memory corruption during text run construction (Windows)

Announced
March 1, 2011
Reporter
Alex Miller
Impact
Critical
Products
Firefox, SeaMonkey
Fixed in
  • Firefox 3.5.17
  • Firefox 3.6.14
  • SeaMonkey 2.0.12

Description

Alex Miller reported that when very long strings were constructed and inserted into an HTML document, the browser would incorrectly construct the layout objects used to display the text. Under such conditions an incorrect length would be calculated for a text run resulting in too small of a memory buffer being allocated to store the text. This issue could be used by an attacker to write data past the end of the buffer and execute malicious code on a victim's computer.

References